In computer security, Discretionary Access Control (DAC) provides an access control model in which a subject with owner permissions is capable of passing permissions to any other subject. However, the fundamental weakness in the DAC model is that the ability to grant and use access also allows malicious software to obtain control of important system resources.
SELinux is an initiative by the National Security Agency (http://www.nsa.gov/selinux/), which attempts to address such weaknesses. SELinux uses Mandatory Access Control (MAC) mechanisms that provide only those necessary accesses a program needs to perform its task (also known as the principle of least privilege). SELinux is an implementation of MAC using Linux Security Modules (LSM) in the Linux kernel, based on the principle of least privilege. A Linux kernel integrating SELinux enforces MAC policies that confine user programs/processes and system servers to the minimum amount of privilege they require for performing tasks. This is independent of the traditional Linux access control mechanisms.
To implement such confinement, SELinux provides a security context by associating access control attributes of the form user:role:type to all subjects (e.g., a medical application) and objects (e.g., files containing a medical record). Within that security context, the “type” attribute represents the type of the subject or the object (e.g., file, directory). The identification of subjects, objects and their access enforcement by means of types is formally known as Type Enforcement (TE). The “role” attribute within the security context is built upon the type attribute. This means that access control in SELinux is primarily enforced via TE. Instead of directly associating a user (e.g., Mr. XYZ—a doctor) with a type (e.g., medicalApplication_t), currently, SELinux associates a user with a role (e.g., Physician Role) and the role with a set of types. The role merely simplifies the management of users and access control is still enforced by the TE paradigm.
Because SELinux uses a policy model that is based on user (identity), roles and types, a program's permission to perform an action on an object (e.g., to open a file/directory/security key/network connection) is determined by: the user who is running the program, the role of the user, the type of the program and the target object. As such, the current SELinux security context is limited to TE only.
With the proliferation of Linux, SELinux is included in most open source and commercial Linux distributions. Further, Trusted Computing (TC), a technology developed and promoted by the Trusted Computing Group (https://www.trustedcomputinggroup.org/home), is also proliferating. There is, therefore, a need for a SELinux policy model with additional attributes.